update and fix karakeep transitive dependency error

flake.lock

@@ -8,11 +8,11 @@
         "treefmt-nix": "treefmt-nix"
       },
       "locked": {
-        "lastModified": 1766810506,
-        "narHash": "sha256-I4BxozsEu205tA7jazufztI8ZQ5p7hcCnjqrSKPz9nI=",
+        "lastModified": 1782994178,
+        "narHash": "sha256-VGc3/2fe6hnOmNSLlOygEAbeS69v7A7rjKDKRzAgE2Q=",
         "owner": "hraban",
         "repo": "cl-nix-lite",
-        "rev": "038e341cede255a83a8f04af114dc95717461d32",
+        "rev": "eb584721e5e799bafe0c6210a8a1a398f90e8ac0",
         "type": "github"
       },
       "original": {
@@ -28,11 +28,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781761792,
-        "narHash": "sha256-rCPytmKNjctLloB6UgK5CRrHSwV4b0ygxtJLPPp8R14=",
+        "lastModified": 1783395956,
+        "narHash": "sha256-AAbexQvDoK+6GFJdhY6kqjA+6ECKRkidgWxkn4gMwAA=",
         "owner": "lnl7",
         "repo": "nix-darwin",
-        "rev": "a1fa429e945becaf60468600daf649be4ba0350c",
+        "rev": "d5bd9cd77aea4c0a8f49e7fd85545671a208ed15",
         "type": "github"
       },
       "original": {
@@ -65,11 +65,11 @@
     "flake-compat": {
       "flake": false,
       "locked": {
-        "lastModified": 1730663653,
-        "narHash": "sha256-kFCUWettiFHDIqxCWWQ9qY8pVh+Lj+XL0Giyy/kdomg=",
+        "lastModified": 1766808011,
+        "narHash": "sha256-s83BS0abtIj7vzUf8JE0209KphfHA6qRw/92D9k/F+0=",
         "owner": "hraban",
         "repo": "flake-compat",
-        "rev": "e5b16676185cb7548581c852f51ce7f3a49bba5e",
+        "rev": "6e0aafdc4c4c2043c66f756d5045374b42184fc5",
         "type": "github"
       },
       "original": {
@@ -179,11 +179,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783134515,
-        "narHash": "sha256-qMoZazubXlXUD9k/syJ/aiWC4X4g73mwVmZ7Z4+rdpM=",
+        "lastModified": 1783744526,
+        "narHash": "sha256-yYVxW+uIbCx0Nt870fbErQbz+b2+3Gwpppe+JbIU+Co=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "b885baad531fa3d3beae2ba9a0712d22974d8016",
+        "rev": "2afec152df4e284d264f8489d16004c264aebf4c",
         "type": "github"
       },
       "original": {
@@ -203,11 +203,11 @@
         "treefmt-nix": "treefmt-nix_2"
       },
       "locked": {
-        "lastModified": 1766810876,
-        "narHash": "sha256-VPElWFQIiP31lXQXEom+L4sl85alZpZn33O4hewsP9k=",
+        "lastModified": 1783182903,
+        "narHash": "sha256-7IteXipJZfFepi5zakxe0jQ5i3vRBQguk0+Gtte1Fu4=",
         "owner": "hraban",
         "repo": "mac-app-util",
-        "rev": "4747968574ea58512c5385466400b2364c85d2d0",
+        "rev": "039f33deef21782d4db97087f426504951239887",
         "type": "github"
       },
       "original": {
@@ -275,11 +275,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1766736597,
-        "narHash": "sha256-BASnpCLodmgiVn0M1MU2Pqyoz0aHwar/0qLkp7CjvSQ=",
+        "lastModified": 1779796641,
+        "narHash": "sha256-ZsIrKmhp4vbBXoXXmR/tBXA/UCsAQiJL9vsgZEduhVY=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f560ccec6b1116b22e6ed15f4c510997d99d5852",
+        "rev": "25f538306313eae3927264466c70d7001dcea1df",
         "type": "github"
       },
       "original": {
@@ -306,11 +306,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1782847225,
-        "narHash": "sha256-JC9PjqKYG9ve5U8aDOLQipp3+KLANBHUvGdLZlxzdKI=",
+        "lastModified": 1783703440,
+        "narHash": "sha256-O3/YajjWo001VUIgD8BwaRdSNLUFe7nZ1qV5TwhRBcw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "95ca1e203c0750115fd4a6f17d5a245dfe6b1edd",
+        "rev": "8f0500b9660505dc3cb647775fe9a978a74b5283",
         "type": "github"
       },
       "original": {
@@ -338,27 +338,27 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1732617236,
-        "narHash": "sha256-PYkz6U0bSEaEB1al7O1XsqVNeSNS+s3NVclJw7YC43w=",
+        "lastModified": 1782999065,
+        "narHash": "sha256-5Dgj5+pIQYZKrXUGaLCk7CKfN3MmpwIhO94++WVxvng=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "af51545ec9a44eadf3fe3547610a5cdd882bc34e",
+        "rev": "80d591ed473cfc46329932c2aadac9b435342c7c",
         "type": "github"
       },
       "original": {
         "owner": "NixOS",
+        "ref": "nixos-26.05",
         "repo": "nixpkgs",
-        "rev": "af51545ec9a44eadf3fe3547610a5cdd882bc34e",
         "type": "github"
       }
     },
     "nixpkgs_4": {
       "locked": {
-        "lastModified": 1761236834,
-        "narHash": "sha256-+pthv6hrL5VLW2UqPdISGuLiUZ6SnAXdd2DdUE+fV2Q=",
+        "lastModified": 1770107345,
+        "narHash": "sha256-tbS0Ebx2PiA1FRW8mt8oejR0qMXmziJmPaU1d4kYY9g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "d5faa84122bc0a1fd5d378492efce4e289f8eac1",
+        "rev": "4533d9293756b63904b7238acb84ac8fe4c8c2c4",
         "type": "github"
       },
       "original": {
@@ -370,11 +370,11 @@
     },
     "nixpkgs_5": {
       "locked": {
-        "lastModified": 1782959384,
-        "narHash": "sha256-xnJJk+ct+D2+wdRxj1wk36w5zV9RVESwRqcklPdt3fM=",
+        "lastModified": 1783522502,
+        "narHash": "sha256-iffAls3iaNTyJC2faYcUXSI+Gp02cDjYl+MygxKl2GI=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "65179426c83bb3f6bc14898b42ea1c6f01d374b0",
+        "rev": "0bb7ec54c8483066ec9d7720e780a5caa71f8612",
         "type": "github"
       },
       "original": {
@@ -408,11 +408,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1783145257,
-        "narHash": "sha256-ToFI5ch+MRCsP82ghZMhkF/YbNmDWMmvvJadvKhDlb8=",
+        "lastModified": 1783781396,
+        "narHash": "sha256-aksKD/uLLuu17Sqaz4Ae2zbExheI5v/U9j9778eCD5U=",
         "owner": "nix-community",
         "repo": "nur",
-        "rev": "c50af1cc06115c76b81c0bbe079248193003e707",
+        "rev": "29c4c5612e67bce09ee3f2f988bebe51ff9e6b81",
         "type": "github"
       },
       "original": {
@@ -443,11 +443,11 @@
         "nixpkgs": "nixpkgs_6"
       },
       "locked": {
-        "lastModified": 1783144302,
-        "narHash": "sha256-NQnzmXwpEAd5tjMBh2+P/y9NknF+WHv5+6yoXoN4h/Y=",
+        "lastModified": 1783747106,
+        "narHash": "sha256-KlepQu/O5m11lAjcJ4ER5bc6bIzyX2UMPDARzMzQfIw=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "fe5aee0952e8e1525533d61defd9e36513db811b",
+        "rev": "e598b37857b895b81020a65a802ef55f5bbed72f",
         "type": "github"
       },
       "original": {
@@ -539,11 +539,11 @@
         "nixpkgs": "nixpkgs_4"
       },
       "locked": {
-        "lastModified": 1766000401,
-        "narHash": "sha256-+cqN4PJz9y0JQXfAK5J1drd0U05D5fcAGhzhfVrDlsI=",
+        "lastModified": 1780220602,
+        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "42d96e75aa56a3f70cab7e7dc4a32868db28e8fd",
+        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
         "type": "github"
       },
       "original": {
@@ -560,11 +560,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1781182279,
-        "narHash": "sha256-V5EQQbDnmdiXGQXrEF1PEL7QYsFqfH8N1E89Z5ONwFk=",
+        "lastModified": 1783336371,
+        "narHash": "sha256-ZisTtweyb7JUwPP54HAXE9TypT8m89dIxDI36Ak0hAs=",
         "owner": "nix-community",
         "repo": "NixOS-WSL",
-        "rev": "5675822ba756e6e56f8f6a5a76e90e0da2ece94d",
+        "rev": "a9620cfa43f0c1c30a46c31ae3c6e58cdb124a14",
         "type": "github"
       },
       "original": {

lib/default.nix

@@ -103,6 +103,9 @@ lib
       config.permittedInsecurePackages = [
         "litestream-0.3.13"
         "electron-36.9.5"
+        # Build-time-only dep of karakeep's frontend; CVEs don't reach
+        # the runtime closure. Remove once nixpkgs bumps it.
+        "pnpm-9.15.9"
       ];
       config.allowUnfree = true;
     }

modules/common/shell/work.nix

@@ -1,67 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-
-{
-
-  home-manager.users.${config.user} = lib.mkIf pkgs.stdenv.isDarwin {
-
-    home.packages =
-      let
-        ldap_scheme = "ldaps";
-        magic_prefix = "take";
-        ldap_port = 3269;
-        jq_parse = pkgs.writeShellScriptBin "ljq" ''
-          jq --slurp \
-            --raw-input 'split("\n\n")|map(split("\n")|map(select(.[0:1]!="#" and length>0)) |select(length > 0)|map(capture("^(?<key>[^:]*:?): *(?<value>.*)") |if .key[-1:.key|length] == ":" then .key=.key[0:-1]|.value=(.value|@base64d) else . end)| group_by(.key) | map({key:.[0].key,value:(if .|length > 1 then [.[].value] else .[].value end)}) | from_entries)' | jq -r 'del(.[].thumbnailPhoto)'
-        '';
-        ldap_script = pkgs.writeShellScriptBin "ldap" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          SEARCH_FILTER="$@"
-          ldapsearch -LLL \
-              -B -o ldif-wrap=no \
-              -E pr=5000/prompt \
-              -H "${ldap_scheme}://''${LDAP_HOST}:${builtins.toString ldap_port}" \
-              -D "${pkgs.lib.toUpper magic_prefix}2\\${pkgs.lib.toLower config.user}" \
-              -w "$(${pkgs._1password-cli}/bin/op item get T2 --fields label=password --reveal)" \
-              -b "dc=''${LDAP_HOST//./,dc=}" \
-              -s "sub" -x "(cn=''${SEARCH_FILTER})" \
-              | ${jq_parse}/bin/ljq
-        '';
-        ldapm_script = pkgs.writeShellScriptBin "ldapm" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].memberOf] | add'
-        '';
-        ldapg_script = pkgs.writeShellScriptBin "ldapg" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "$@" | jq '[ .[].member] | add'
-        '';
-        ldapl_script = pkgs.writeShellScriptBin "ldapl" ''
-          if ! [ "$LDAP_HOST" ]; then
-              echo "No LDAP_HOST specified!"
-              exit 1
-          fi
-          ${ldap_script}/bin/ldap "*$@*" | jq -r '.[].name'
-        '';
-      in
-      [
-        ldap_script
-        ldapm_script
-        ldapg_script
-        ldapl_script
-        jq_parse
-      ];
-  };
-}

modules/darwin/homebrew.nix

@@ -1,56 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-
-  # Homebrew - Mac-specific packages that aren't in Nix
-  config = lib.mkIf pkgs.stdenv.isDarwin {
-
-    # # Requires Homebrew to be installed
-    system.activationScripts.preActivation.text = ''
-      if ! xcode-select --version 2>/dev/null; then
-        $DRY_RUN_CMD xcode-select --install
-      fi
-      if ! /opt/homebrew/bin/brew --version 2>/dev/null; then
-        $DRY_RUN_CMD /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
-      fi
-    '';
-
-    # Add homebrew paths to CLI path
-    home-manager.users.${config.user}.home.sessionPath = [
-      "/opt/homebrew/bin/"
-      "/opt/homebrew/opt/trash/bin/"
-    ];
-
-    homebrew = {
-      enable = true;
-      onActivation = {
-        autoUpdate = false; # Don't update during rebuild
-        cleanup = "zap"; # Uninstall all programs not declared
-        upgrade = true;
-      };
-      global = {
-        brewfile = true; # Run brew bundle from anywhere
-      };
-      brews = [
-        "trash" # Delete files and folders to trash instead of rm
-        "jiratui" # Terminal program to manage Jira
-      ];
-      casks = [
-        "1password" # 1Password will not launch from Nix on macOS
-        # "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
-        "keybase" # GUI on Nix not available for macOS
-        # "logitech-g-hub" # Mouse and keyboard management
-        "logitune" # Logitech webcam firmware
-        "meetingbar" # Show meetings in menu bar
-        "scroll-reverser" # Different scroll style for mouse vs. trackpad
-        "notunes" # Don't launch Apple Music with the play button
-        "steam" # Not packaged for Nixon macOS
-        "epic-games" # Not packaged for Nix
-      ];
-    };
-  };
-}

platforms/home-manager/modules/nmasur/presets/services/dock.nix

@@ -48,7 +48,7 @@ in
         tilesize = 44;
 
         persistent-apps = map mkDockApp [
-          "/Applications/1Password.app"
+          "${pkgs._1password-gui}/Applications/1Password.app"
           "${pkgs.slack}/Applications/Slack.app"
           "/System/Applications/Calendar.app"
           "${pkgs.firefox-unwrapped}/Applications/Firefox.app"

platforms/home-manager/modules/nmasur/profiles/work.nix

@@ -44,7 +44,7 @@ in
     ];
 
     home.file.".Brewfile".text = /* homebrew */ ''
-      cask "1password" # 1Password will not launch from Nix on macOS
+      # cask "1password" # 1Password will not launch from Nix on macOS
       # cask "gitify" # Git notifications in menu bar (downgrade manually from 4.6.1)
       # cask "logitech-g-hub" # Mouse and keyboard management
       cask "logitune" # Logitech webcam firmware
@@ -56,7 +56,7 @@ in
     nmasur.presets = {
       fonts.enable = lib.mkDefault true;
       programs = {
-        _1password.enable = lib.mkDefault true;
+        # _1password.enable = lib.mkDefault true;
         atuin.enable = lib.mkDefault true;
         aws-ssh.enable = lib.mkDefault true;
         bash.enable = lib.mkDefault true;

platforms/nix-darwin/modules/nmasur/presets/programs/_1password.nix

@@ -0,0 +1,29 @@
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.nmasur.presets.programs._1password;
+in
+
+{
+  options.nmasur.presets.programs._1password.enable = lib.mkEnableOption "1Password password manager";
+
+  config = lib.mkIf cfg.enable {
+    allowUnfreePackages = [
+      "1password"
+      "_1password-gui"
+      "1password-cli"
+    ];
+
+    programs._1password.enable = true;
+    programs._1password-gui = {
+      enable = true;
+      # Certain features, including CLI integration and system authentication support,
+      # require enabling PolKit integration on some desktop environments (e.g. Plasma).
+      # polkitPolicyOwners = [ "yourUsernameHere" ];
+    };
+  };
+}

platforms/nix-darwin/modules/nmasur/profiles/base.nix

@@ -17,10 +17,11 @@ in
     system.primaryUser = config.nmasur.settings.username;
 
     nmasur.presets = {
-      # programs = {
-      # fish.enable = lib.mkDefault true;
-      # homebrew.enable = lib.mkDefault true;
-      # };
+      programs = {
+        _1password.enable = lib.mkDefault true;
+        # fish.enable = lib.mkDefault true;
+        # homebrew.enable = lib.mkDefault true;
+      };
       services = {
         # daily-summary.enable = lib.mkDefault false;
         # dock.enable = lib.mkDefault true;